small refactoring

Signed-off-by: Quentin JEROME <[email protected]>

kunai-common/src/events.rs

@@ -277,6 +277,10 @@ impl EventInfo {
         self.process.tg_uuid.random = rand;
         self.parent.tg_uuid.random = rand;
     }
+
+    pub fn switch_type(&mut self, new: Type) {
+        self.etype = new
+    }
 }
 
 #[cfg(target_arch = "bpf")]
@@ -340,7 +344,7 @@ impl<T> Event<T> {
 
     pub fn switch_type(mut self, new: Type) -> Self {
         // we record original event type
-        self.info.etype = new;
+        self.info.switch_type(new);
         self
     }
 }

kunai-common/src/events/correlation.rs

@@ -18,7 +18,6 @@ pub type CorrelationEvent = Event<CorrelationData>;
 // the data in this structure should always be serializable
 // to a byte array, it should not contain any pointers
 pub struct CorrelationData {
-    //pub origin: Type,
     pub argv: Buffer<MAX_ARGV_SIZE>,
     pub exe: Path,
     pub paths: [Option<Path>; 1],

kunai/src/bin/main.rs

@@ -72,6 +72,11 @@ struct CorrelationData {
 }
 
 impl CorrelationData {
+    #[inline(always)]
+    fn command_line_string(&self) -> String {
+        self.command_line.join(" ")
+    }
+
     fn free_memory(&mut self) {
         self.resolved = HashMap::new();
     }
@@ -230,7 +235,7 @@ impl EventProcessor {
     fn get_command_line(&self, key: u128) -> String {
         let mut cl = String::from("?");
         if let Some(corr) = self.correlations.get(&key) {
-            cl = corr.command_line.join(" ");
+            cl = corr.command_line_string();
         }
         cl
     }

kunai/src/info.rs

@@ -101,14 +101,17 @@ pub struct StdEventInfo {
 }
 
 impl StdEventInfo {
+    #[inline(always)]
     pub fn correlation_key(&self) -> u128 {
         CorrInfo::corr_key(self.info.process.tg_uuid)
     }
 
+    #[inline(always)]
     pub fn parent_correlation_key(&self) -> u128 {
         CorrInfo::corr_key(self.info.parent.tg_uuid)
     }
 
+    #[inline]
     pub fn with_event_info(mut info: EventInfo, rand: u32) -> Self {
         // we set the random part needed to generate uuids for events
         info.set_uuid_random(rand);
@@ -123,6 +126,7 @@ impl StdEventInfo {
         }
     }
 
+    #[inline]
     pub fn with_additional_fields(mut self, fields: AdditionalFields) -> Self {
         self.additional = fields;
         self